Safari 27 Killed Identity Resolution — What It Means for WooCommerce Tracking
Quick Answer: Safari 27 blocks identity resolution vendors at the network domain level, preventing tracking scripts from making any requests — not just restricting their cookies (PPC Land, 2026). With Apple devices representing 40–60% of ecommerce traffic, WooCommerce stores relying on third-party identity graphs for retargeting, frequency capping, and cross-device measurement are losing those capabilities entirely on Safari. CNAME cloaking no longer works around this restriction. The only tracking approach that survives is server-side first-party: events sent from your own domain to GA4, Google Ads, and Meta are treated as legitimate same-origin requests.
In this article
- What did Safari 27 change about identity resolution tracking?
- How is network-level blocking different from Safari’s previous cookie restrictions?
- What is identity resolution and why did Safari target it?
- Does CNAME cloaking still work on Safari 27?
- How much WooCommerce traffic comes from Apple devices?
- What ad tracking features break when identity resolution is blocked?
- Does server-side tracking survive Safari 27’s identity blocking?
- What should WooCommerce stores do about Safari 27 tracking loss?
What did Safari 27 change about identity resolution tracking?
Safari 27 blocks identity resolution vendors at the network domain level, preventing their scripts from making any requests at all — not just capping their cookies or stripping their parameters. That’s a fundamental escalation. Previous Safari versions let identity vendors load, run, and fingerprint — they just restricted how long the resulting cookies survived. Safari 27 stops the vendor’s JavaScript from calling home entirely (PPC Land, 2026), which means no fingerprint is built, no device graph is queried, and no probabilistic match is attempted.
For WooCommerce store owners, this isn’t a gradual tightening. It’s a cliff. Any tracking workflow that depended on an identity resolution service — whether you knew it or not — stopped working on Safari the day the update shipped. And because identity resolution often sits behind your ad platform’s “enhanced conversions” or “advanced matching” features, the breakage can be invisible until you notice your reported ROAS dropping on Apple traffic.
Safari 27 blocks identity resolution vendors at the network domain level, preventing all tracking requests — not just limiting cookies (PPC Land, 2026).
How is network-level blocking different from Safari’s previous cookie restrictions?
Network-level blocking prevents the identity vendor’s domains from making any network requests, while previous cookie restrictions only limited what happened after those requests completed. Safari’s Intelligent Tracking Prevention (ITP) used to cap third-party cookie lifetimes, strip tracking parameters from URLs, and downgrade storage access — all meaningful restrictions, but ones that still allowed the tracking infrastructure to operate. CNAME-cloaked third-party cookies were already capped at 7 days by Safari ITP (PPC Land, 2026), yet the underlying scripts could still load, execute, and attempt new tracking approaches.
Safari 27 moved the enforcement boundary upstream. Instead of cleaning up after tracking scripts, it prevents them from running. Think of it as the difference between letting someone into your house and confiscating their camera versus not opening the door. The earlier approach left room for creative workarounds — CNAME cloaking, first-party data bridging, server-to-server syncs initiated by the vendor’s client-side code. The new approach eliminates the surface those workarounds relied on.
Related: Why does Safari ITP cap WooCommerce attribution cookies at seven days?
| Enforcement level | What Safari restricts | What still works |
|---|---|---|
| Cookie-level (ITP, pre-Safari 27) | Third-party cookie lifetimes, CNAME caps at 7 days, parameter stripping | Scripts load; fingerprinting; device-graph queries; server syncs |
| Network-level (Safari 27) | All requests to identity vendor domains blocked | First-party same-origin requests only |
What is identity resolution and why did Safari target it?
Identity resolution connects a single visitor’s activity across different websites, devices, and sessions using fingerprinting, device graphs, or probabilistic matching — and Safari targeted it because it’s the mechanism that enables cross-site tracking, which directly undermines the privacy protections Apple has built into its ecosystem. The practice works by collecting browser signals (screen resolution, installed fonts, WebGL renderer, timezone) and matching them against a shared identity graph that links the same person across publishers, advertisers, and data brokers.
From Apple’s perspective, identity resolution is the layer that makes all other privacy restrictions ineffective. You can cap cookies, strip URL parameters, and block storage APIs, but if a vendor can still fingerprint the browser and match the result against a cross-site graph, the user is still tracked. Apple’s US ad revenue hit an estimated $8.85 billion in 2026 (eMarketer via PPC Land, 2026) — and Apple’s privacy stance is also its competitive positioning in the ad market, which adds commercial incentive to the technical enforcement.
Does CNAME cloaking still work on Safari 27?
No — CNAME cloaking no longer bypasses Safari’s restrictions. CNAME cloaking disguises third-party tracker domains by creating a DNS alias that routes requests through a subdomain of your own site (e.g., track.yourstore.com resolving to vendor.trackingco.com). Safari ITP already saw through this trick and capped CNAME-cloaked cookies at 7 days (PPC Land, 2026), but the vendor’s scripts could still load and operate within that window.
Safari 27 makes the CNAME irrelevant. The blocking happens at the network level against the identity vendor’s infrastructure, regardless of how the DNS is configured. Even if your CNAME resolves through your own subdomain, Safari identifies the ultimate destination as a blocked identity provider and prevents the request. The door that CNAME cloaking propped open is now welded shut.
CNAME-cloaked third-party cookies were already capped at 7 days by Safari ITP — Safari 27 now blocks the underlying vendors entirely (PPC Land, 2026).
How much WooCommerce traffic comes from Apple devices?
Apple devices typically represent 40–60% of ecommerce site traffic (Industry data, 2025), meaning Safari’s identity blocking creates a measurement blind spot across the majority of your visitor base. The exact share depends on your market — US-based stores with higher average order values tend to skew toward the upper end, while international stores with broader device mixes may sit closer to 40%.
The question isn’t X. The question is whether your current tracking stack reports accurate numbers for the 40–60% of sessions running Safari. If your conversion measurement depends on an identity resolution vendor — even indirectly, through your ad platform’s enhanced matching — then your reported ROAS on Apple traffic is now understated. You’re spending the same ad budget but seeing fewer attributed conversions, which makes profitable campaigns look unprofitable and pushes your bidding algorithms toward the wrong audiences.
What ad tracking features break when identity resolution is blocked?
When identity resolution is blocked, advertisers lose cross-site retargeting audiences, frequency capping across publishers, and cross-device measurement on Apple devices — all of which relied on identity graphs to connect the same user across sessions and sites. Each of these features depends on recognising a returning visitor, and without the identity layer, the visitor is a stranger every time.
Here’s what that means in practice for a WooCommerce store:
- Retargeting breaks: your ad platform can’t build Safari-based audiences from browsing behaviour across sites, so Dynamic Product Ads stop reaching Apple users who viewed but didn’t buy.
- Frequency capping fails: without cross-publisher identity, the same person sees your ad repeatedly on different sites because each impression looks like a new user.
- Cross-device attribution gaps: a shopper who browses on iPhone and buys on desktop can’t be connected, so the mobile touchpoint gets zero credit — and your mobile ROAS looks worse than it is.
- Lookalike audiences degrade: the seed audience your ad platform uses to find similar buyers shrinks by however many Apple users it can no longer identify, reducing both the quality and the reach of the lookalike.
Does server-side tracking survive Safari 27’s identity blocking?
Yes — server-side tracking from your own first-party domain is unaffected by Safari 27 because the browser treats requests to your own server as legitimate same-origin resource requests, not as blocked third-party identity resolution infrastructure. When a shopper triggers an event on your WooCommerce store — an add-to-cart, a checkout, a purchase — a first-party server endpoint on your domain collects it and forwards the data to GA4, Google Ads, Meta CAPI, or BigQuery directly from server to server. Safari never sees a third-party vendor in the request chain.
Server-side first-party tracking recovers 30–40% of the conversion data typically lost on Apple devices (Industry consensus, 2024) because the measurement pipeline stays entirely within your own infrastructure. The browser sends the event to your domain; your server enriches it with order data, hashes the customer’s email for ad platform matching, and dispatches it. No identity graph, no third-party script, no domain that Safari would block.
Tools like Transmute Engine handle this by routing WooCommerce events through a managed first-party endpoint — GA4, Google Ads, Meta CAPI, TikTok, and BigQuery all receive the event from your own server, without requiring a GTM server-side container. Because the tracking originates from your domain, it survives Safari’s cookie caps, parameter stripping, and now network-level identity blocking.
Server-side first-party tracking recovers 30–40% of conversion data typically lost on Apple devices because Safari treats your own domain’s requests as legitimate (PPC Land, 2026).
What should WooCommerce stores do about Safari 27 tracking loss?
Move conversion tracking to a server-side first-party endpoint that collects events on your own domain and forwards them to GA4, Google Ads, and Meta — this is the only tracking approach that survives both Safari’s cookie restrictions and its new network-level identity blocking. Any third-party vendor in the request chain is now a single point of failure on Apple traffic, and the blocking list will only grow.
The transition has three practical steps:
- Audit your current stack: check whether your ad platform’s “enhanced conversions” or “advanced matching” routes through an identity resolution vendor. If the vendor’s domain appears in your network requests on Safari and fails to load, you’re already losing data.
- Set up a first-party server-side endpoint: events fire from your WooCommerce store to a server on your own domain, which then dispatches to GA4 Measurement Protocol, Google Ads API, Meta Conversions API, and any other downstream destination. The endpoint is same-origin — Safari has no reason to block it.
- Validate your measurement baseline: compare Safari vs. Chrome conversion rates before and after the migration. A healthy server-side setup should close most of the gap. If Safari conversion rates remain significantly lower, something in the pipeline still depends on a third-party call.
Related: What’s the best Safari tracking solution for WooCommerce?
Key Takeaways
- Network-level, not cookie-level: Safari 27 blocks identity resolution vendors from making any requests — previous workarounds like CNAME cloaking no longer apply.
- 40–60% of your traffic is affected: Apple devices make up the majority of ecommerce sessions for most stores, and every one now runs under this restriction.
- Retargeting, frequency capping, and cross-device measurement break: any feature that relied on cross-site identity graphs stops working on Safari.
- First-party server-side is the surviving path: events sent from your own domain to ad platforms are same-origin — Safari doesn’t block them.
Safari 27 blocks identity resolution infrastructure at the network domain level, preventing tracking vendors from making any network requests rather than merely restricting their cookies as previous Safari versions did.
Previous Safari versions capped cookie lifetimes and stripped tracking parameters while still allowing tracking scripts to load and make requests — Safari 27 prevents the identity resolution services from executing any network calls at all, making workarounds impossible.
Identity resolution is the practice of connecting a visitor’s activity across different websites using fingerprinting, device graphs, or probabilistic matching — Safari targeted it because it enables cross-site user tracking that undermines the privacy protections Apple has built into its ecosystem.
No — CNAME cloaking, which disguises third-party trackers by routing them through a subdomain DNS alias, was already restricted to 7-day cookie caps by Safari ITP, and Safari 27 now blocks the underlying identity resolution vendors at the network level regardless of CNAME configuration.
Apple devices typically represent 40 to 60 percent of ecommerce site traffic, meaning Safari’s tracking restrictions affect the majority of visitors for most online stores and create a proportional blind spot in conversion measurement.
When identity resolution is blocked, advertisers lose cross-site retargeting audiences, frequency capping across publishers, and cross-device measurement on Apple devices — all of which relied on identity graphs to connect the same user across different sessions and sites.
Yes — server-side tracking from your own first-party domain is unaffected by Safari 27 because the browser treats requests to your own server as legitimate same-origin resource requests, not as blocked third-party identity resolution infrastructure.
Move conversion tracking to a server-side first-party endpoint that collects events on your own domain and forwards them to GA4, Google Ads, and Meta — this is the only approach that survives both Safari’s cookie restrictions and its new network-level identity blocking.